Executive brief
A vulnerability in BIND 9, a widely used software for translating domain names into IP addresses, could allow attackers to bypass security access controls. By sending a specially crafted DNS request, an attacker may trick the server into misidentifying their IP address, potentially gaining unauthorized access to restricted network resources. This issue primarily impacts systems configured with 'default-allow' security rules.
Technical details
A stack use-after-return vulnerability (CWE-562) exists in the 'named' server component of BIND 9 when processing DNS queries signed with SIG(0). The flaw occurs during the handling of these signed requests, where a stack variable address is returned and subsequently used, potentially causing an Access Control List (ACL) to incorrectly match or mismatch an IP address. An attacker with the ability to send DNS requests can exploit this to bypass IP-based restrictions. The impact is most severe in 'default-allow' configurations where specific IPs are denied; 'default-deny' configurations are expected to fail-secure. Patches are available in versions 9.20.21 and 9.21.20.
Affected products
- ISC BIND 9 9.20.0 to 9.20.20, 9.21.0 to 9.21.19, 9.20.9-S1 to 9.20.20-S1
Timeline
- 2026-03-18: other: Early notification provided
- 2026-03-25: advisory: Public disclosure by ISC
- 2026-03-25: patched: Fixed versions 9.20.21 and 9.21.20 released